gmail_oauth.py

# MIT License
# Copyright (c) 2013 Jean-Tiare LE BIGOT <admin@jtlebi.fr>
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.

from bottle import route, run, template, redirect
from bottle import request as req

import urllib.parse
import requests

import imaplib

# TODO: (important) state token for anti-forgery
#       add real keys
#       token storage, upate, validation

#test local
OAUTH_URL = 'https://accounts.google.com/o/oauth2/auth'
OAUTH_URL_TOKEN = 'https://accounts.google.com/o/oauth2/token'

CLIENT_ID = '1234.apps.googleusercontent.com'
CLIENT_SECRET = 'bogus'
REDIRECT_URI = 'http://localhost:8080/gmail_oauth_cb'

access_token = "bogus"
refresh_token = "bogus"
username = "username@gmail.com"

def refresh_token():
    r = requests.post(OAUTH_URL_TOKEN, data={
        'client_id': CLIENT_ID,
        'client_secret': CLIENT_SECRET,
        'refresh_token': refresh_token,
        'grant_type': 'refresh_token',
    })
    global access_token
    access_token  = r.json()['access_token']

@route('/')
def auth():
    user_url = "{}?{}".format(OAUTH_URL, urllib.parse.urlencode({
                                  'client_id': CLIENT_ID,
                                  'scope': "https://mail.google.com/",
                                  'login_hint': username,
                                  'redirect_uri': REDIRECT_URI,
                                  'access_type': 'offline',
                                  'response_type': 'code',
                                  #debug mode ? --> force
                                  'approval_prompt': 'force',
                              }))
    redirect(user_url)

@route('/gmail_oauth_cb')
def oauth_cb():
    #TODO: token storage, upate, validation
    code = req.params['code']
    r = requests.post(OAUTH_URL_TOKEN, data={
        'code': code,
        'client_id': CLIENT_ID,
        'client_secret': CLIENT_SECRET,
        'redirect_uri': REDIRECT_URI,
        'grant_type': 'authorization_code',
    })
    global access_token
    global refresh_token
    access_token  = r.json()['access_token']
    if 'refresh_token' in r.json():
        refresh_token = r.json()['refresh_token']
    return redirect('/test_imap')

@route('/test_imap')
def test_imap():
    auth_string = 'user=%s\1auth=Bearer %s\1\1' % (username, access_token)
    imap_conn = imaplib.IMAP4_SSL('imap.gmail.com')
    imap_conn.debug = 4
    imap_conn.authenticate('XOAUTH2', lambda x: auth_string)
    return str(imap_conn.select('INBOX'))

run(host='localhost', port=8080)